SYN floods - possible solution? (fwd)

Fri Sep 13 08:30:45 UTC 1996

On Fri, 13 Sep 1996, Alexis Rosen wrote:

> But... I still don't believe that this is a good global solution. Most ISPs
> can't cope with this. The clue level I've been seeing among many of the
> ISP "engineers" and "systems administrators" who have called in the last
> few days to ask for help ("is your problem happening to me too???") is
> astonishingly low. :-(

Tell me about it. But if this kind of solution could be packaged up in a
single box with two ethernet interfaces then a lot of less clueful ISP's
could easily install such a thing and protect their whole network. If the
box also provided default filters on source addresses that could help
solve another problem as well. The fear of attack may well be the force
which overcomes inertia here and gets more ISP's up to speed on these
issues just like AIDS brought the issues of safe sex to the forefront.

> I also have no clue what I'd choose to implement this on. It *could* be
> done in a unix kernel but that's probably a really *bad* choice. I'm sure
> plenty of people out there know some good possibilities, though.

Well, the advantage to using something like FreeBSD is that it is freely
available, well-documented, and eleigible for creating commercial products
as long as you check copyrights carefully. Most parts of FreeBSD have no
commercial use restrictions like GNU does.

And FreeBSD already has the basic functionality in it including support
for readily available hardware including 10baseT and 100baseTx and FDDI
interfaces. Building this kind of box would be mostly an excercise in
subtraction and it may well be possible to strip enough stuff out that it
can all be booted off a 1.44 megabyte diskette into a diskless 486 or
Pentium box with a RAMdisk.

At that point all an ISP needs to do is download a file, a disk writing
utility (RAWRITE.EXE) and assemble a box with certain standard components
like their choice of 3 types of network card as mentioned above. If the
box included ssh for the admin interface maybe it could create a precedent
for router manufacturers?

NOTE: I copied this one to freebsd-hackers

Michael Dillon                   -               ISP & Internet Consulting
Memra Software Inc.              -                  Fax: +1-604-546-3049
http://www.memra.com             -               E-mail: michael at memra.com